<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Add user information in Logstash | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'get-started-logstash-user.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/get-started-logstash-user.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/get-started-logstash-user.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/get-started-logstash-user.html" rel="nofollow" target="_blank">../en/get-started-logstash-user.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="secure-cluster.html">Secure a cluster</a></span>
»
<span class="breadcrumb-link"><a href="security-getting-started.html">Tutorial: Getting started with security</a></span>
»
<span class="breadcrumb-node">Add user information in Logstash</span>
</div>
<div class="navheader">
<span class="prev">
<a href="get-started-roles.html">« Assign roles</a>
</span>
<span class="next">
<a href="get-started-verify-users.html">View system metrics in Kibana »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="get-started-logstash-user"></a>Add user information in Logstash<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/security/get-started-security.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>
<p>In order for Logstash to send data successfully to Elasticsearch, you must configure its
authentication credentials in the Logstash configuration file.</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>Configure Logstash to use the <code class="literal">logstash_internal</code> user and the password that you
created:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<p>If you don’t mind having passwords visible in your configuration file, add
the following <code class="literal">user</code> and <code class="literal">password</code> settings in the <code class="literal">demo-metrics-pipeline.conf</code>
file in your Logstash directory:</p>
<div class="pre_wrapper lang-ruby">
<pre class="programlisting prettyprint lang-ruby">...

output {
  elasticsearch {
    hosts =&gt; "localhost:9200"
    manage_template =&gt; false
    index =&gt; "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user =&gt; "logstash_internal" <a id="CO496-1"></a><i class="conum" data-value="1"></i>
    password =&gt; "your_password" <a id="CO496-2"></a><i class="conum" data-value="2"></i>
  }
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO496-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Specify the <code class="literal">logstash_internal</code> user that you created earlier in this tutorial.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO496-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>Specify the password that you chose for this user ID.</p>
</td>
</tr>
</table>
</div>
</li>
<li class="listitem">
<p>If you prefer not to put your user ID and password in the configuration file,
store them in a keystore instead.</p>
<p>Run the following commands to create the Logstash
keystore and add the secure settings:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">set +o history
export LOGSTASH_KEYSTORE_PASS=mypassword <a id="CO497-1"></a><i class="conum" data-value="1"></i>
set -o history
./bin/logstash-keystore create
./bin/logstash-keystore add ES_USER
./bin/logstash-keystore add ES_PWD</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO497-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>You can optionally protect access to the Logstash keystore by storing a password
in an environment variable called <code class="literal">LOGSTASH_KEYSTORE_PASS</code>. For more information,
see <a href="https://www.elastic.co/guide/en/logstash/7.7/keystore.html#keystore-password" class="ulink" target="_top">Keystore password</a>.</p>
</td>
</tr>
</table>
</div>
<p>When prompted, specify the <code class="literal">logstash_internal</code> user and its password for the
<code class="literal">ES_USER</code> and <code class="literal">ES_PWD</code> values.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>The Logstash keystore differs from the Kibana keystore. Whereas the Kibana
keystore enables you to store <code class="literal">kibana.yml</code> settings by name, the Logstash keystore
enables you to create arbitrary names that you can reference in the Logstash
configuration. To learn more, see
<a href="https://www.elastic.co/guide/en/logstash/7.7/keystore.html" class="ulink" target="_top">Secrets keystore for secure settings</a>.</p>
</div>
</div>
<p>You can now use these <code class="literal">ES_USER</code> and <code class="literal">ES_PWD</code> keys in your configuration
file.  For example, add the <code class="literal">user</code> and <code class="literal">password</code> settings in the
<code class="literal">demo-metrics-pipeline.conf</code> file as follows:</p>
<div class="pre_wrapper lang-ruby">
<pre class="programlisting prettyprint lang-ruby">...

output {
  elasticsearch {
    hosts =&gt; "localhost:9200"
    manage_template =&gt; false
    index =&gt; "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user =&gt; "${ES_USER}"
    password =&gt; "${ES_PWD}"
  }
}</pre>
</div>
</li>
</ul>
</div>
</li>
<li class="listitem">
<p>Start Logstash by using the appropriate method for your environment.</p>
<p>For example, to
run Logstash from a command line, go to the Logstash directory and enter the following
command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/logstash -f demo-metrics-pipeline.conf</pre>
</div>
<p>To start Logstash as a service, see
<a href="https://www.elastic.co/guide/en/logstash/7.7/running-logstash.html" class="ulink" target="_top">Running Logstash as a service on Debian or RPM</a>.</p>
</li>
<li class="listitem">
If you were connecting directly from Metricbeat to Elasticsearch, you would need
to configure authentication credentials for the Elasticsearch output in the Metricbeat
configuration file. In
<a href="https://www.elastic.co/guide/en/elastic-stack-get-started/7.7/get-started-elastic-stack.html" class="ulink" target="_top">Getting started with the Elastic Stack</a>,
however, you configured
Metricbeat to send the data to Logstash for additional parsing, so no extra
settings are required in Metricbeat. For more information, see
<a href="https://www.elastic.co/guide/en/beats/metricbeat/7.7/securing-metricbeat.html" class="ulink" target="_top">Securing Metricbeat</a>.
</li>
<li class="listitem">
<p>Start Metricbeat by using the appropriate method for your environment.</p>
<p>For example, on macOS, run the following command from the Metricbeat directory:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./metricbeat -e</pre>
</div>
<p>For more methods, see <a href="https://www.elastic.co/guide/en/beats/metricbeat/7.7/metricbeat-starting.html" class="ulink" target="_top">Starting Metricbeat</a>.</p>
</li>
</ol>
</div>
<p>Wait a few minutes for new data to be sent from Metricbeat to Logstash and Elasticsearch.</p>
</div>
<div class="navfooter">
<span class="prev">
<a href="get-started-roles.html">« Assign roles</a>
</span>
<span class="next">
<a href="get-started-verify-users.html">View system metrics in Kibana »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>